                        :hostprivkey (str ssldir "/private_keys/master.pem")
                        :hostpubkey  (str ssldir "/public_keys/master.pem")}]
 
-  ;; TODO verify contents of each created file (PE-3238)
   (deftest initialize-ca!-test
-    (testing "Generated SSL file"
-      (try
-        (initialize-ca! ca-settings 512)
+    (try
+      (initialize-ca! ca-settings 512)
+
+      (testing "Generated SSL file"
         (doseq [file (vals cadir-contents)]
           (testing file
-            (is (fs/exists? file))))
-        (finally
-          (fs/delete-dir cadir)))))
-
-  ;; TODO verify contents of each created file (PE-3238)
+            (is (fs/exists? file)))))
+
+      (testing "cacrl"
+        (let [crl (-> cadir-contents :cacrl utils/pem->crl)]
+          (assert-issuer crl "CN=test ca")))
+
+      (testing "cacert"
+        (let [cert (-> cadir-contents :cacert utils/pem->cert)]
+          (is (utils/certificate? cert))
+          (assert-subject cert "CN=test ca")
+          (assert-issuer cert "CN=test ca")))
+
+      (testing "cakey"
+        (let [key (-> cadir-contents :cakey utils/pem->private-key)]
+          (is (utils/private-key? key))
+          (is (= 512 (utils/keylength key)))))
+
+      (finally
+        (fs/delete-dir cadir))))
+
   (deftest initialize-master!-test
-    (testing "Generated SSL file"
-      (try
-        (initialize-master! ssldir-contents "master" "test ca"
-                            (utils/pem->private-key cakey)
-                            (utils/pem->cert cacert)
-                            512)
+    (try
+      (initialize-master! ssldir-contents "master" "Puppet CA: localhost"
+                          (utils/pem->private-key cakey)
+                          (utils/pem->cert cacert)
+                          512)
+
+      (testing "Generated SSL file"
         (doseq [file (vals ssldir-contents)]
           (testing file
-            (is (fs/exists? file))))
-        (finally
-          (fs/delete-dir ssldir)))))
-
+            (is (fs/exists? file)))))
+
+      (testing "hostcert"
+        (let [cert (-> ssldir-contents :hostcert utils/pem->certs first)]
+          (is (utils/certificate? cert))
+          (assert-subject cert "CN=master")
+          (assert-issuer cert "CN=Puppet CA: localhost")))
+
+      (testing "localcacert"
+        (let [cacert (-> ssldir-contents :localcacert utils/pem->certs first)]
+          (is (utils/certificate? cacert))
+          (assert-subject cacert "CN=Puppet CA: localhost")
+          (assert-issuer cacert "CN=Puppet CA: localhost")))
+
+      (testing "hostprivkey"
+        (let [key (-> ssldir-contents :hostprivkey utils/pem->private-key)]
+          (is (utils/private-key? key))
+          (is (= 512 (utils/keylength key)))))
+
+      (finally
+        (fs/delete-dir ssldir))))
 
   (deftest initialize!-test
     (testing "Generated SSL file"

(def cacrl (str cadir "/ca_crl.pem"))
(def csrdir (str cadir "/requests"))
(def signeddir (str cadir "/signed"))

(deftest get-certificate-test
  (testing "returns CA certificate when subject is 'ca'"


(deftest get-certificate-revocation-list-test
  (testing "`get-certificate-revocation-list` returns a valid CRL file."
    (let [crl (-> (get-certificate-revocation-list cacrl)
                  StringReader.
                  utils/pem->crl)]
      (assert-issuer crl "CN=Puppet CA: localhost"))))

(let [ssldir          (ks/temp-dir)
      cadir           (str ssldir "/ca")
